Fault positioning method and device for cluster system, equipment, storage medium and product

Abstract

The invention discloses a fault positioning method and device of a cluster system, equipment, a storage medium and a product, and relates to the technical field of artificial intelligence, the disclosed fault positioning method of the cluster system comprises the steps that running snapshot information of the current cluster system is acquired, and the running snapshot information comprises log information and index information of multiple dimensions; preprocessing the log information to obtain a log information vector, and preprocessing the index information of each dimension to obtain an index information vector; performing fusion processing on the log information vector and the index information vector to obtain a fusion feature vector; and processing the fusion feature vector through a pre-trained extreme gradient lifting classifier to obtain a fault type of the current cluster system, and positioning a fault root cause. The problem of inaccurate fault type and fault root cause positioning of the cluster system is solved, and the accuracy of fault type and fault root cause positioning of the cluster system is improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to fault location methods, devices, equipment, storage media and products for cluster systems. Background Technology

[0002] Currently, in the operation and maintenance of cluster systems, fault type identification and root cause localization are the most time-consuming and labor-intensive aspects of the work. Because cluster systems typically consist of dozens or even hundreds of servers, involving multiple software and hardware components, this complex host system architecture increases the difficulty of troubleshooting, as faults can occur in any component and may be affected by other components. For online services and mission-critical applications, fault diagnosis needs to be completed as quickly as possible to minimize business downtime.

[0003] In related technologies, graph neural networks are used as classifiers, and time-series performance indicators of historical faults are used as training data. They mainly use the performance indicators of faulty nodes as features to train the classifier. The influencing factors considered are relatively singular, and it is impossible to accurately locate the fault type and root cause of the cluster system. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, device, storage medium, and product for fault location in a cluster system, aiming to improve the accurate location of fault types and root causes in cluster systems.

[0005] To achieve the above objectives, this application proposes a fault location method for a cluster system, comprising: Obtain the current cluster system's runtime snapshot information, which includes log information and multi-dimensional metric information; Log information is preprocessed to obtain a log information vector, and indicator information for each dimension is preprocessed to obtain an indicator information vector. The log information vector and the indicator information vector are fused to obtain a fused feature vector; The fused feature vector is processed by a pre-trained extreme gradient boosting classifier to obtain the fault type of the current cluster system and locate the root cause of the fault. The extreme gradient boosting classifier is trained by mapping historical operation snapshot information with historical fault types and historical fault root causes.

[0006] In one embodiment, preprocessing the log information to obtain a log information vector includes: The log information is converted to a text format. The text-formatted log information is cleaned to obtain cleaned log information; The cleaned log information is classified into text types to obtain the log information's log type; One-hot encoding is used to encode each log type of log information separately, and the feature vectors obtained from the encoding of each log type are concatenated to obtain the log information vector.

[0007] In one embodiment, the indicator information for each dimension is preprocessed to obtain an indicator information vector including: The indicator information of each dimension is normalized; The normalized indicator information from each dimension is concatenated to obtain an indicator information vector.

[0008] In one embodiment, the fault location method for a cluster system further includes: Obtain historical operation snapshot information, which includes historical fault operation snapshot information and historical normal operation snapshot information; Preprocess the historical operation snapshot information to obtain the historical operation snapshot information vector; By setting vector labels for historical operation snapshot information vectors, we can obtain the historical fault types and root causes corresponding to the historical operation snapshot information. One-hot encoding is used to encode historical fault types and historical fault root causes, resulting in encoded historical fault type vectors and historical fault root cause vectors. The historical fault type vector, historical fault root cause vector, and historical operation snapshot information vector are concatenated to obtain the historical fusion feature vector; The initial extreme gradient boosting classifier is trained using historical fusion feature vectors to obtain a trained extreme gradient boosting classifier.

[0009] In one embodiment, the historical runtime snapshot information includes historical log information and historical indicator information across multiple dimensions. Preprocessing the historical runtime snapshot information yields a historical runtime snapshot information vector, including: Historical log information is preprocessed to obtain a historical log information vector, and historical indicator information of each dimension is preprocessed to obtain a historical indicator information vector. By concatenating the historical log information vector and the historical indicator information vector, the historical operation snapshot information vector is obtained.

[0010] In one embodiment, the initial extreme gradient boosting classifier is trained using historical fusion feature vectors to obtain a trained extreme gradient boosting classifier, which includes: Based on the historical fusion feature vector, the length of the vector label corresponding to each historical operation snapshot information is obtained, as well as the historical actual fault type, historical actual fault root cause, historical predicted fault type and historical predicted fault root cause corresponding to each historical operation snapshot information; The loss value corresponding to each historical operation snapshot is calculated using the logarithmic loss function based on the length of the vector label corresponding to each historical operation snapshot, the actual historical fault type, the actual historical fault root cause, the predicted historical fault type, and the predicted historical fault root cause. The total loss value is obtained by summing the loss values ​​corresponding to each historical snapshot. If the total loss value is greater than the preset loss value, the classifier parameters of the initial extreme gradient boosting classifier are adjusted, and the log loss function is recalculated. If the total loss value is less than or equal to the preset loss value, stop training and output the extreme gradient boosting classifier.

[0011] Furthermore, to achieve the above objectives, this application also proposes a fault location device for a cluster system, comprising: The acquisition module is used to acquire the current cluster system's runtime snapshot information, which includes log information and multi-dimensional metric information. The preprocessing module is used to preprocess log information to obtain log information vectors, and to preprocess indicator information of each dimension to obtain indicator information vectors. Fusion processing is used to fuse log information vectors and indicator information vectors to obtain fused feature vectors. The analysis module is used to process the fused feature vectors through a pre-trained extreme gradient boosting classifier to obtain the fault type of the current cluster system and locate the root cause of the fault. The extreme gradient boosting classifier is trained by mapping historical operation snapshot information with historical fault types and historical fault root causes.

[0012] In addition, to achieve the above objectives, this application also proposes a fault location device for a cluster system, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the fault location method for the cluster system as described above.

[0013] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the fault location method for the cluster system as described above.

[0014] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the fault location method for a cluster system as described above.

[0015] This application obtains the current cluster system's operational snapshot information, which includes log information and multi-dimensional indicator information. Next, the log information is preprocessed to obtain a log information vector, and the indicator information for each dimension is preprocessed separately to obtain indicator information vectors. The log information vector and indicator information vector are then fused to obtain a fused feature vector. A pre-trained extreme gradient boosting classifier is used to process the fused feature vector to determine the fault type of the current cluster system and locate the root cause of the fault. Because the process of locating the fault type and root cause of the cluster system comprehensively considers the log information and multi-dimensional indicator information during the cluster system's operation, enriching the factors considered, and combining this with the extreme gradient boosting classifier to process the fused feature vector of this information, compared to the graph neural network processing method of related technologies, this approach not only improves the efficiency of fault type and root cause location but also enhances the accuracy of fault type and root cause identification. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the overall process of the fault location method for the cluster system in this application; Figure 2 A flowchart illustrating the first embodiment of the fault location method for the cluster system of this application; Figure 3 A flowchart illustrating the second embodiment of the fault location method for the cluster system in this application; Figure 4 This is a schematic diagram of the module structure and functional modules of the fault location device of the cluster system in the embodiments of this application; Figure 5 This is a schematic diagram illustrating the working principle of the extreme gradient boosting classifier in this application.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] Currently, in the operation and maintenance of cluster systems, fault type identification and root cause localization are the most time-consuming and labor-intensive aspects of the work. Because cluster systems typically consist of dozens or even hundreds of servers, involving multiple software and hardware components, this complex host system architecture increases the difficulty of troubleshooting, as faults can occur in any component and may be affected by other components. For online services and mission-critical applications, fault diagnosis needs to be completed as quickly as possible to minimize business downtime.

[0023] In related technologies, graph neural networks are used as classifiers, with historical failure time-series performance indicators as training data. This approach primarily uses the performance indicators of faulty nodes as features to train the classifier, resulting in a relatively singular consideration of influencing factors. This makes it difficult to accurately pinpoint the fault type and root cause of the cluster system. Furthermore, using graph neural networks as classifiers and historical failure time-series performance indicators as training data increases algorithm complexity, potentially slowing down fault response and impacting the efficiency of fault type and root cause identification.

[0024] To address the aforementioned shortcomings, this application proposes a fault localization method for cluster systems. The main technical solution includes: acquiring current cluster system runtime snapshot information, which includes log information and multi-dimensional indicator information; preprocessing the log information to obtain a log information vector, and preprocessing the indicator information of each dimension separately to obtain indicator information vectors; fusing the log information vector and indicator information vector to obtain a fused feature vector; and processing the fused feature vector using a pre-trained extreme gradient boosting classifier to obtain the fault type of the current cluster system and locate the root cause of the fault. The extreme gradient boosting classifier is trained using the mapping relationship between historical runtime snapshot information and historical fault types and root causes. Because the method comprehensively considers log information and multi-dimensional indicator information during the cluster system's operation, enriching the consideration factors, and combining the extreme gradient boosting classifier to process the fused feature vector of this information, compared to the graph neural network processing method of related technologies, this method not only improves the efficiency of fault type and root cause localization but also enhances the accuracy of fault type and root cause identification.

[0025] It should be noted that this application trains an extreme gradient boosting classifier using historical runtime snapshot information to monitor the operational status of the cluster system based on its characteristic information. During monitoring, the system periodically collects and updates various cluster metrics, such as CPU (Central Processing Unit) utilization, memory usage, and network traffic, and analyzes them in conjunction with historical fault data to gain a more comprehensive understanding of the cluster system's operational status and promptly detect potential fault signs. This classifier can periodically determine whether a fault has occurred based on the current cluster runtime snapshot and effectively identify potential fault conditions in the cluster system by learning the characteristics of different fault modes in historical data. Furthermore, if a fault occurs, this application can locate the root cause and determine the fault type. By analyzing various characteristics and metrics of the current fault and comparing them with historical runtime snapshot information, the system can accurately determine the root cause of the fault and classify it into different fault types, thus providing important reference for subsequent fault handling.

[0026] like Figure 1 As shown, Figure 1 This is a schematic diagram of the overall process of the fault location method for the cluster system of this application. The whole system includes two parts: a data training module and a fault determination module. The data training module includes two parts: data preprocessing and classifier training.

[0027] The data training module includes collecting historical runtime snapshot information, which includes historical failure runtime snapshots and historical normal operation snapshots. This information includes log data and various performance metrics. Next, the historical failure runtime snapshots and historical normal operation snapshots are represented as feature vectors, and then divided into training and validation sets. The training set is input into an extreme gradient boosting classifier for training, and the validation set is used for validation to obtain an extreme gradient boosting classifier with satisfactory performance.

[0028] The fault determination module comprises two parts: periodically acquiring operational snapshots and determining faults. After obtaining the trained extreme gradient boosting classifier through the data training module, operational snapshot information of the cluster system is collected in real time. The collected operational snapshot information is preprocessed and then input into the trained extreme gradient boosting classifier. The extreme gradient boosting classifier classifies and identifies the features of the input operational snapshot information and outputs the fault type and root cause.

[0029] Specifically, in this application, it is first necessary to extract sufficient historical fault operation snapshot information. This historical fault operation snapshot information refers to a snapshot of the entire cluster system's operation at the time of a past fault, including log information and indicator information of all nodes in the cluster during this period. These two pieces of information are then converted into feature vectors as samples for training the extreme gradient boosting classifier. Afterwards, after using the extreme gradient boosting classifier for fault judgment, the judgment results of the extreme gradient boosting classifier need to be adjusted according to the actual situation. Using the historical snapshot information and judgment labels obtained during operation, the extreme gradient boosting classifier is periodically updated to improve the accuracy of fault type judgment and root cause localization. The specific implementation method is described in the second embodiment.

[0030] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or a fault location device for a cluster system capable of performing the above functions. The following description uses a fault location device for a cluster system as an example to illustrate this embodiment and the subsequent embodiments.

[0031] Based on this, embodiments of this application provide a fault location method for a cluster system, referring to... Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the fault location method for the cluster system of this application.

[0032] In this embodiment, the fault location method for the cluster system includes steps S10 to S40: Step S10: Obtain the current cluster system's runtime snapshot information, which includes log information and multi-dimensional metric information.

[0033] A cluster system is a system composed of multiple computers or servers connected by a network to perform tasks together, thereby improving computing power, storage capacity and system reliability. It provides highly available and scalable computing resources to support large-scale data processing and application deployment.

[0034] Among them, runtime snapshot information refers to the status record of the cluster system at a specific moment, including system log information, performance indicators, etc., which is used to analyze the system status, detect anomalies, and troubleshoot faults.

[0035] Log information consists of text or structured data that records events, errors, warnings, and other information that occur during the operation of the cluster system. It provides a detailed record of system behavior, helping developers and operations personnel understand the system's operating status and locate problems.

[0036] Among them, the indicator information reflects quantitative data on the performance of the cluster system, such as CPU utilization, memory usage, network bandwidth, and disk I / O (Input / Output), which are used to monitor system performance and promptly identify performance bottlenecks and anomalies.

[0037] In one feasible implementation, system monitoring tools such as Prometheus (an open-source system monitoring and alerting toolkit) and Zabbix (an open-source monitoring tool primarily used to monitor network parameters, server status, and the performance of various applications) are used to collect logs and metrics in real time and save snapshots periodically.

[0038] In another feasible implementation, log and metric information is periodically retrieved from cluster nodes via scripts or APIs (Application Programming Interfaces) and stored in a central database or file system to obtain current cluster system snapshot information.

[0039] Step S20: Preprocess the log information to obtain a log information vector, and preprocess the indicator information of each dimension to obtain an indicator information vector.

[0040] The log information is preprocessed, such as through text vectorization and feature extraction, to become a numerical vector, resulting in a log information vector that is easy for the extreme gradient boosting classifier to process. This vector serves as the input to the extreme gradient boosting classifier for training or prediction.

[0041] In this process, the indicator information is transformed into a numerical vector through preprocessing such as normalization and standardization. This vector is also used as the input to the extreme gradient boosting classifier and is used together with the log information vector for training or prediction.

[0042] In one feasible implementation, preprocessing log information to obtain log information vectors includes: using natural language processing techniques such as word embedding models or BERT models (a pre-trained language model based on the Transformer architecture) to convert log text into vectors. Alternatively, using feature extraction methods such as TF-IDF (a commonly used weighted technique for information retrieval and data mining) or word frequency statistics to convert log information into sparse vectors, followed by dimensionality reduction processing to obtain preprocessed log information vectors.

[0043] In one feasible implementation, preprocessing the indicator information for each dimension to obtain the indicator information vector includes: normalizing the indicator information for each dimension, scaling it to the [0, 1] interval, and then concatenating them into a vector to obtain the indicator information vector. Alternatively, the indicator information can be standardized to conform to a normal distribution, and then the principal components can be extracted as the indicator information vector.

[0044] Step S30: The log information vector and the indicator information vector are fused to obtain the fused feature vector.

[0045] Among them, the comprehensive feature vector obtained by fusing log information vector and indicator information vector through processes such as concatenation and weighted summation provides a more comprehensive representation of the system state and improves the accuracy of the classifier by enhancing the extreme gradient.

[0046] In one feasible implementation, the log information vector and the indicator information vector are concatenated into a longer vector to obtain the fused feature vector.

[0047] In another feasible implementation, a weighted average or machine learning model such as a neural network is used to fuse the two vectors to obtain a more compact fused feature vector.

[0048] Step S40: The fused feature vector is processed by a pre-trained extreme gradient boosting classifier to obtain the fault type of the current cluster system and locate the root cause of the fault. The extreme gradient boosting classifier is trained by mapping historical operation snapshot information with historical fault types and historical fault root causes.

[0049] Among them, the extreme gradient boosting classifier is a high-efficiency machine learning classification algorithm that optimizes classification performance by combining gradient boosting trees. It classifies fused feature vectors and predicts the fault type and root cause of cluster systems.

[0050] Among them, the fault type refers to the category of faults that may occur in the cluster system, such as hardware faults, software faults, network faults, etc., which helps operation and maintenance personnel quickly understand the nature of the fault and take corresponding measures.

[0051] Among them, the root cause of the fault is the fundamental reason for the fault, such as hardware aging, software errors, network configuration errors, etc. It provides clues for troubleshooting and repair, and reduces the downtime of the cluster system.

[0052] In one feasible implementation, the fused feature vector is classified and predicted using the extreme gradient boosting classifier from either Scikit-learn (an open-source Python-based machine learning library providing a rich set of algorithms and tools for data mining and analysis) or XGBoost (an optimization machine learning algorithm based on gradient boosting decision trees). The training process of the extreme gradient boosting classifier can be customized, and hyperparameters such as the learning rate and the number of trees can be optimized to improve classification performance.

[0053] In this embodiment, the log information and multi-dimensional indicator information during the operation of the cluster system are comprehensively considered in the process of locating the fault type and root cause of the cluster system, which enriches the consideration factors. The extreme gradient boosting classifier is used to process the fusion feature vector of this information. Compared with the graph neural network processing method of related technologies, this not only improves the efficiency of locating the fault type and root cause, but also improves the accuracy of locating the fault type and root cause.

[0054] In one feasible implementation, preprocessing the log information to obtain a log information vector includes: Step S21: Convert the log information to a text format to obtain log information.

[0055] In one feasible implementation, if the log information was originally stored in a non-plain text format such as a structured database or JSON (JavaScript Object Notation, a lightweight data exchange format), it can be converted into plain text format using appropriate parsing tools such as SQL (Structured Query Language) or JSON parsers.

[0056] In another feasible implementation, for logs that have been stored as text but have inconsistent formats, such as different timestamp formats or different delimiters, regular expressions or scripts can be written to unify the format.

[0057] Step S22: Clean the log information in text format to obtain cleaned log information.

[0058] In one feasible implementation, irrelevant information such as advertisements and debugging information in the log information can be removed using regular expressions or keyword filtering techniques to obtain cleaned log information.

[0059] In another feasible implementation, spelling errors, formatting errors, etc. in log information can be corrected using error correction techniques in natural language processing or predefined rule sets to obtain cleaned log information.

[0060] Step S23: Perform text classification on the cleaned log information to obtain the log type of the log information.

[0061] In one feasible implementation, pre-trained BERT models are used for text classification, which have performed well on multiple natural language processing tasks.

[0062] In another feasible implementation, traditional machine learning text classification methods, such as TF-IDF combined with support vector machines or Naive Bayes, are used to classify the cleaned log information to obtain the log type of the log information.

[0063] In another feasible implementation, the cleaned log information is input into the fastText classification model to obtain the log type. The fastText classification model is trained based on the mapping relationship between historical log information and historical log types. During training, a large amount of labeled historical log information can be used as a training set to train the fastText classification model through supervised learning. Alternatively, transfer learning techniques can be employed during training, using a model pre-trained on similar tasks as a starting point for fine-tuning to adapt to the specific log classification task.

[0064] Step S24: Use one-hot encoding to encode each log type of log information separately, and concatenate the feature vectors obtained from the encoding of each log type to obtain the log information vector.

[0065] One-hot encoding is a method for converting categorical data into binary vectors. For each category, a new binary feature is created; the feature value is 1 when a sample belongs to that category, and 0 otherwise. In this application, one-hot encoding can convert categorical data into numerical data, facilitating model processing; simultaneously, it avoids the potential for misleading sequential behavior that might result from directly converting categorical data into integer encoding.

[0066] In one feasible implementation, encoding each log type of log information using one-hot encoding includes: for each log type, creating a new binary feature vector with a length equal to the total number of log types; when a log belongs to that type, the corresponding position is set to 1, and the remaining positions are set to 0; or, if there are many log types, a sparse vector representation such as CSR (a file format used to request digital certificates from certificate authorities) can be used to store the one-hot encoded feature vector to save memory space.

[0067] In one feasible implementation, the feature vectors encoded by each log type are concatenated to obtain a log information vector. This can be achieved by directly concatenating the one-hot encoded vectors of each log type sequentially into a long vector. Alternatively, if there is a hierarchical relationship or correlation between log types, hierarchical one-hot encoding or embedding techniques can be used to capture these relationships before concatenation.

[0068] Taking the fastText classification model, also known as the fast text classification model, as an example for processing log information, log information usually has a templated structure, that is, log information of the same type may appear at different times and locations, but they have similar formats and contents, so it is easier to parse. In this embodiment, the fastText classification model is used to parse log information. The fastText classification model has the characteristics of fast speed and can complete the parsing of long log files in a timely manner. The specific steps are: (1) Collect log information and organize it into text format log information. Each log information should include information such as timestamp, level, source / module and message content; (2) Clean the collected log information, including removing special characters, punctuation marks and numbers; (3) Add labels to the log information according to the level or other features of the log information; (4) Input the processed log information as training data into the fastText classification model, and obtain the trained fastText classification model by adjusting the parameters of the fastText classification model, such as learning rate and vector dimension. After obtaining the fastText classification model, input the currently running log information, and the fastText classification model can output the type of the current log information and its probability. After obtaining the output of the fastText classification model, the type with the highest probability is selected as the current log type. One-hot encoding is then used to encode the log type, converting each type into a binary vector. The length of this vector is the number of log types. The element at the position corresponding to the current category is set to 1, and other elements are set to 0. For example, for log messages with 3 types, the first type is represented by (1, 0, 0), the second type by (0, 1, 0), and the third type by (0, 0, 1). In this way, log information can be represented by a vector representing the log type. Let represent , where i is the number of log types.

[0069] In this embodiment, log information is converted to text format to achieve uniformity of text format. Subsequent cleaning and encoding of the log information can reduce the amount of log information processing and thus improve the efficiency of log information vector generation.

[0070] In one feasible implementation, the indicator information for each dimension is preprocessed to obtain an indicator information vector including: Step S25: Normalize the indicator information of each dimension.

[0071] Normalization is a data preprocessing technique that transforms the values ​​of different features to the same scale, typically the [0, 1] or [-1, 1] interval. This helps eliminate the impact of differences in feature value ranges on the performance of machine learning models. Normalization avoids problems such as unstable model training or slow convergence caused by differences in feature value ranges. In the gradient descent algorithm, normalization can accelerate the convergence process because a consistent feature value range helps the gradient update more evenly. Normalized feature values ​​are easier to interpret and compare because they are all on the same scale.

[0072] In one feasible implementation, the index information of each dimension can be normalized by using a minimum-maximum normalization method, scaling the index information of each dimension to the range of [0, 1].

[0073] In another feasible implementation, the Z-Score (z-score, which is the difference between a number and the mean divided by the standard deviation) standardization method is used to normalize the indicator information of each dimension, and the feature values ​​of the indicator information of each dimension are converted into a normal distribution with a mean of 0 and a standard deviation of 1.

[0074] Step S26: The normalized indicator information of each dimension is concatenated to obtain the indicator information vector.

[0075] In one feasible implementation, the indicator information of each dimension after normalization is concatenated in sequence into a long vector to obtain the indicator information vector.

[0076] In another feasible implementation, if the features of indicator information in different dimensions have different importance to fault location, they can be assigned different weights during splicing to obtain an indicator information vector.

[0077] Specifically, considering that metrics information of different dimensions usually have different units of measurement, it is necessary to normalize the metric information of each dimension. Specifically, it is necessary to extract the metrics of each instance in the cluster system, such as CPU utilization, memory utilization, and network transmission rate. Then, normalization is performed so that the values ​​of each dimension of the metric information are distributed between 0 and 1. This avoids the different impacts of metric information of different units on subsequent model prediction or training, causing the classifier to have different sensitivities to different parameters. Finally, arranging the normalized metric information of each instance into a vector yields the metric information vector describing the metrics of all instances in the entire cluster. This metric information vector can be represented as: .

[0078] Where m represents the number of instances. This indicates that the m-th instance has a total of One indicator, This represents the j-th index of the i-th instance.

[0079] In this embodiment, the indicator information of each dimension is normalized, and then the normalized indicator information of each dimension is concatenated to obtain the indicator information vector. This avoids the different impacts of indicator information of different dimensions on subsequent model prediction or training, which could lead to the problem that the classifier has different sensitivities to different parameters.

[0080] Reference Figure 3 Based on the first embodiment of this application, in the second embodiment of this application, the fault location method for a cluster system further includes: Step S01: Obtain historical operation snapshot information, which includes historical fault operation snapshot information and historical normal operation snapshot information.

[0081] In one feasible implementation, historical runtime snapshots are extracted from a database or log files. Using SQL queries or log file parsing tools, runtime status information of the cluster system at different points in time is extracted, including CPU utilization, memory usage, network traffic, etc. For example, the SQLite3 library in Python can be used to connect to the database and execute SQL queries to retrieve data.

[0082] In another feasible implementation, a monitoring system is used to capture runtime snapshots in real time. A monitoring system is deployed to collect real-time runtime status information of the cluster system and periodically save it as snapshot files.

[0083] Step S02: Preprocess the historical runtime snapshot information to obtain the historical runtime snapshot information vector.

[0084] In one feasible implementation, key features such as CPU usage and memory occupancy are selected from historical snapshot information and normalized to eliminate the impact of feature value range differences on model performance.

[0085] In another feasible implementation, historical snapshot information is treated as time series data, and time series analysis methods such as moving average and differencing are applied to extract features, and dimensionality reduction techniques are used to reduce the feature dimensions.

[0086] Step S03: Set vector labels for the historical operation snapshot information vector to obtain the historical fault types and root causes corresponding to the historical operation snapshot information.

[0087] Vector labels are a way to associate data samples with their corresponding categories or attributes. In machine learning, labels are often used in supervised learning to indicate the correct output for each training sample. Vector labels represent these labels as vectors, making them easier to compute and process. In classification tasks, vector labels guide the model in learning how to map input data to the correct categories.

[0088] In one feasible implementation, fault type or cause labels can be manually assigned to each snapshot sample based on historical records or expert knowledge. For example, an Excel spreadsheet can be created to record the fault type and cause for each snapshot sample and then imported as a label vector.

[0089] In another feasible implementation, semi-supervised learning is performed using a small number of labeled samples and a large number of unlabeled samples, and the model predicts the labels of the unlabeled samples.

[0090] Step S04: Use one-hot encoding to encode the historical fault types and historical fault root causes to obtain the encoded historical fault type vector and historical fault root cause vector.

[0091] In one feasible implementation, a custom function can be written to convert the fault type and cause into a one-hot encoded vector based on a dictionary mapping.

[0092] After obtaining the historical operation snapshot information vectors, it is necessary to assign corresponding labels to each historical operation snapshot information vector. This is done by mapping each historical fault type and historical fault root cause to numbers, and then encoding the historical fault type and historical fault root cause using one-hot encoding, resulting in encoded historical fault type vectors and historical fault root cause vectors. Concatenating the encoded historical fault type vectors and historical fault root cause vectors yields the label representation. ,in, arrive This represents the historical fault type; the element corresponding to the historical fault type is 1, and the others are 0. arrive The vector represents the root cause of a historical failure, with each element corresponding to a historical root cause set to 1, and the rest set to 0. After the above preprocessing, we obtain a vector of historical failure types, a vector of historical failure root causes, and a vector of historical operation snapshot information. To avoid data skew, these vectors include an equal number of randomly selected historical normal operation snapshot information samples. All elements of the label vectors corresponding to these historical normal operation snapshot information samples are 0, because these historical normal operation snapshot information samples do not have failures, and therefore have neither failure types nor root causes.

[0093] Step S05: Concatenate the historical fault type vector, the historical fault root cause vector, and the historical operation snapshot information vector to obtain the historical fusion feature vector.

[0094] Step S06: Train the initial extreme gradient boosting classifier using the historical fusion feature vector to obtain the trained extreme gradient boosting classifier.

[0095] After obtaining the preprocessed sample data, in order to better evaluate the model's performance, the data needs to be randomly shuffled and divided into training and test sets according to a certain ratio.

[0096] The aforementioned historical fusion feature vector includes normal samples and fault samples. After randomly mixing fault samples and normal samples, they are divided into training and test sets and trained using an extreme gradient boosting classifier. This allows the classifier with good prediction accuracy and generalization performance to be extracted for fault detection in subsequent cluster operations. Unlike other classifiers, the extreme gradient boosting classifier can use pruning techniques to better identify features with a greater impact on the classification results. It can also split at the point of highest information gain, reducing the risk of overfitting on irrelevant features due to an excessive number of features, and finding suitable split points for continuous values ​​like indices. Furthermore, considering that the output of the extreme gradient boosting classifier can be a vector, simply setting the output of the classifier and providing training data with vector labels during training allows the trained classifier to simultaneously output the predicted fault type and possible root causes. Additionally, since the training data includes normal operation snapshot information, the extreme gradient boosting classifier can also learn to determine whether the model has experienced a fault during training. Therefore, the resulting extreme gradient boosting classifier can not only determine whether a fault has occurred, but also predict the fault type and possible root causes if a fault has occurred.

[0097] It should be noted that the extreme gradient boosting classifier mentioned above is the XGBoost classifier. (See reference...) Figure 5The principle of the XGBoost classifier is to integrate multiple weak classifiers to form a strong classifier, and the weak classifiers are decision trees. The XGBoost classifier trains multiple decision trees and adds the prediction values ​​of each decision tree at the leaf nodes to obtain the final prediction value. However, the following principles exist when training each tree: (1) Each tree uses all samples during training; (2) There is a sequence in training and integrating these decision trees, that is, each decision tree after the first decision tree is trained based on the prediction values ​​of all the previous decision trees, and the current prediction value is equal to the previous prediction value plus the prediction value of the current decision tree, which is equivalent to correcting the overall prediction through the current decision tree; (3) Each tree uses all the data when it is generated. Based on the above principles, for a dataset with n samples, the objective function of the t-th decision tree in the XGBoost classifier is as follows: .

[0098] In the above formula Let be the loss function, where and Let represent the i-th sample out of n samples and its corresponding label value, respectively. This indicates the first t-1 trees for each sample. The predicted value, which is known when training the t-th tree. This represents the current t-th tree for the sample. The predicted value. The loss function can be chosen by the user and is mainly used to measure the difference between the label value and the predicted value. And the other... Representing the present The algorithmic complexity of trees depends on parameters such as the tree's depth and the number of leaf nodes. The complexity can generally be expressed by the following formula: .

[0099] Where T represents the total number of leaf nodes in the t-th tree, and This represents the value of the j-th leaf node. and This is a constant used to control the penalty applied to each parameter. The larger the value, the higher the penalty for the number of nodes and depth. The larger the value, the greater the penalty for the leaf node value.

[0100] In this embodiment, a historical fusion feature vector is obtained by concatenating the historical fault type vector, the historical fault root cause vector, and the historical operation snapshot information vector. This historical fusion feature vector is then used to train the initial extreme gradient boosting classifier, resulting in a trained extreme gradient boosting classifier. Because the influence of historical operation snapshot information is considered during the training process, the accuracy of the extreme gradient boosting classifier in predicting fault types and root causes is improved.

[0101] In one feasible implementation, the historical operation snapshot information includes historical log information and historical indicator information across multiple dimensions. Preprocessing the historical operation snapshot information to obtain a historical operation snapshot information vector includes: preprocessing the historical log information to obtain a historical log information vector, and preprocessing the historical indicator information for each dimension separately to obtain historical indicator information vectors. The historical log information vector and the historical indicator information vector are then concatenated to obtain the historical operation snapshot information vector. The method of preprocessing the historical log information and historical indicator information is the same as the method used in the first embodiment for processing log information and indicator information, and will not be described again here.

[0102] In this embodiment, historical log information is converted to a text format, thus unifying the text format of historical log information. Subsequent cleaning and encoding of the historical log information reduces the processing load and improves the efficiency of generating historical log information vectors. Furthermore, by normalizing historical indicator information across various dimensions and then concatenating the normalized information, a historical indicator information vector is obtained. This avoids the problem of different dimensions of historical indicator information causing different impacts during subsequent model prediction or training, preventing classifiers from exhibiting varying sensitivities to different parameters.

[0103] In one feasible implementation, the initial extreme gradient boosting classifier is trained using historical fusion feature vectors to obtain a trained extreme gradient boosting classifier, which includes: Step S061: Based on the historical fusion feature vector, obtain the length of the vector label corresponding to each historical operation snapshot information, as well as the historical actual fault type, historical actual fault root cause, historical predicted fault type, and historical predicted fault root cause corresponding to each historical operation snapshot information.

[0104] Step S062: Based on the length of the vector label corresponding to each historical operation snapshot information, the historical actual fault type, the historical actual fault root cause, the historical predicted fault type, and the historical predicted fault root cause, the logarithmic loss function is used to calculate the loss value corresponding to each historical operation snapshot information.

[0105] Since this is a multi-class classification problem, a log loss function is used. The log loss function penalizes the probability distribution of the model's output, encouraging the model to make more accurate probability predictions, thereby improving model performance in classification problems. Furthermore, since the sample labels were vectorized through one-hot encoding during data processing, the loss function in the XGBoost classifier should be adjusted accordingly. The improved log loss function is as follows: .

[0106] Where C represents the sample The length of the corresponding vector label, and This represents the actual value of the i-th element. Let represent the predicted value of the i-th element. The above formula means that the logarithmic loss function is calculated for each element in the vector label, and then summed. Meanwhile, due to the predicted values ​​in the XGBoost classifier... It depends not only on the predicted value of the t-th tree itself. It also depends on the predictions of the first t-1 trees, i.e. Then we have the following expression: .

[0107] Based on the above formula, and considering that the labels are represented using vectorization, the objective function of the initial XGBoost classifier can be transformed into the following form: .

[0108] By performing a Taylor expansion of the above equation, we have: .

[0109] in, and They represent the loss function respectively The first and second derivatives are given, since the loss functions of the first t-1 trees are already known when training the t-th tree. and This is also a known constant. Minimizing the above equation yields the value of the leaf node j in the current decision tree: .

[0110] in, , .

[0111] The above formula and These represent the first derivatives for the N samples under leaf node j. and second derivative Perform summation.

[0112] The information gain of each feature is expressed as: .

[0113] Where GL and HL represent the sum of gradients and the sum of second derivatives of the left child node, respectively, GR and HR represent the sum of gradients and the sum of second derivatives of the right child node, respectively, and γ represents the minimum gain required for splitting (pre-pruning hyperparameter).

[0114] The information gain of each splitting scheme can be calculated by traversing all features and feature values, and the leaf node corresponding to the maximum information gain is selected as the splitting point. The goal of the XGBoost classifier is to minimize the objective function. By selecting the splitting point with the maximum gain, it can be ensured that the value of the objective function is reduced to the maximum extent at each splitting step. That is, by selecting the splitting point with the maximum information gain, this application can more accurately identify the fault type because fault samples within the same node are more likely to belong to the same category after splitting, which helps in fault root cause localization. Since key features (i.e., features that have a great influence on fault type judgment) are selected multiple times during the splitting process, the XGBoost classifier, by selecting the splitting point with the maximum gain, ultimately constructs an XGBoost classifier that can meet the needs of fault type judgment and fault root cause localization.

[0115] By combining the above mathematical expressions with information gain, an XGBoost classifier capable of fault type identification and root cause localization can be trained. Then, by combining this with timed execution, the inspection function can be implemented. Specifically, first, snapshot information of the current cluster operation is exported periodically. This snapshot information is then converted into feature vectors that describe log and indicator information using the methods described above. These feature vectors are then imported into the trained XGBoost classifier, which outputs the corresponding prediction vector. Since the XGBoost classifier's features are a strong classifier resulting from the ensemble of multiple weak classifiers, the fault type in the output prediction vector is not a specific type with a value of 1 and others being 0. This is also true for the part representing the root cause node. Therefore, the top n largest values ​​can be output as the possible fault types and root cause nodes. For example, the top three most likely fault types and the most likely root causes can be output, which greatly reduces the time spent troubleshooting nodes and fault types.

[0116] Step S063: Add the loss values ​​corresponding to each historical snapshot information to obtain the total loss value.

[0117] Step S064: If the total loss value is greater than the preset loss value, adjust the classifier parameters of the initial extreme gradient boosting classifier and recalculate using the logarithmic loss function.

[0118] In step S065, if the total loss value is less than or equal to the preset loss value, stop training and output the extreme gradient boosting classifier.

[0119] In this embodiment, the XGBoost classifier is used. On one hand, it can handle the large number of features from the entire cluster's runtime snapshot without overfitting. On the other hand, by calculating the information gain of each feature, the importance of the feature and the splitting node of the current feature can be determined, allowing for better handling of continuous values ​​such as index data. Combined with an improved logarithmic loss function, the XGBoost classifier can adapt to vector labels.

[0120] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the fault location method of the cluster system of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0121] Based on the same inventive concept, this application also provides a fault location device for a cluster system, please refer to... Figure 4 , Figure 4 This is a functional module diagram of a fault location device for a cluster system according to an embodiment of this application. The fault location device for the cluster system includes: The acquisition module 10 is used to acquire the current cluster system's running snapshot information, which includes log information and multi-dimensional indicator information. The preprocessing module 20 is used to preprocess the log information to obtain a log information vector, and to preprocess the indicator information of each dimension to obtain an indicator information vector. Fusion processing 30 is used to fuse log information vectors and indicator information vectors to obtain fused feature vectors; The analysis module 40 is used to process the fused feature vector through a pre-trained extreme gradient boosting classifier to obtain the fault type of the current cluster system and locate the root cause of the fault. The extreme gradient boosting classifier is trained by mapping the historical operation snapshot information with the historical fault types and historical fault root causes.

[0122] Optionally, the preprocessing module 20 is further configured to: convert the log information into a format to obtain text-format log information; clean the text-format log information to obtain cleaned log information; classify the cleaned log information into text to obtain the log type of the log information; encode each log type of the log information using one-hot encoding, and concatenate the feature vectors obtained from encoding each log type to obtain the log information vector.

[0123] Optionally, the preprocessing module 20 is also used to: normalize the indicator information of each dimension; and concatenate the normalized indicator information of each dimension to obtain an indicator information vector.

[0124] Optionally, the fault location device of the cluster system further includes a training module, which is used to: acquire historical operation snapshot information, including historical fault operation snapshot information and historical normal operation snapshot information; preprocess the historical operation snapshot information to obtain a historical operation snapshot information vector; set vector labels on the historical operation snapshot information vector to obtain the historical fault type and historical fault root cause corresponding to the historical operation snapshot information; encode the historical fault type and historical fault root cause using a one-hot encoding method to obtain the encoded historical fault type vector and historical fault root cause vector; concatenate the historical fault type vector, historical fault root cause vector, and historical operation snapshot information vector to obtain a historical fusion feature vector; and train the initial extreme gradient boosting classifier using the historical fusion feature vector to obtain the trained extreme gradient boosting classifier.

[0125] Optionally, the training module is also used to: preprocess historical log information to obtain a historical log information vector, and preprocess historical indicator information of each dimension to obtain a historical indicator information vector; and concatenate the historical log information vector and the historical indicator information vector to obtain a historical running snapshot information vector.

[0126] Optionally, the training module is further configured to: obtain the length of the vector label corresponding to each historical operation snapshot information, and the historical actual fault type, historical actual fault root cause, historical predicted fault type, and historical predicted fault root cause corresponding to each historical operation snapshot information, based on the historical fused feature vector; calculate the loss value corresponding to each historical operation snapshot information using the logarithmic loss function based on the length of the vector label corresponding to each historical operation snapshot information, the historical actual fault type, the historical actual fault root cause, the historical predicted fault type, and the historical predicted fault root cause; sum the loss values ​​corresponding to each historical operation snapshot information to obtain the total loss value; if the total loss value is greater than the preset loss value, adjust the classifier parameters of the initial extreme gradient boosting classifier and recalculate using the logarithmic loss function; if the total loss value is less than or equal to the preset loss value, stop training and output the extreme gradient boosting classifier.

[0127] The fault location device for a cluster system provided in this application, employing the fault location method for a cluster system in the above embodiments, can improve the accurate location of fault types and root causes in the cluster system. Compared with the prior art, the beneficial effects of the fault location device for a cluster system provided in this application are the same as those of the fault location method for a cluster system provided in the above embodiments, and other technical features in the fault location device for a cluster system are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0128] Based on the same inventive concept, this application provides a fault location device for a cluster system. The fault location device for a cluster system includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the fault location method of the cluster system in the above embodiments.

[0129] The fault location device for the cluster system provided in this application, employing the fault location method for the cluster system in the above embodiments, can improve the accurate location of fault types and root causes in the cluster system. Compared with the prior art, the beneficial effects of the fault location device for the cluster system provided in this application are the same as those of the fault location method for the cluster system provided in the above embodiments, and other technical features in the fault location device for the cluster system are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0130] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0131] Based on the same inventive concept, this application provides a computer-readable storage medium having computer-readable program instructions (i.e., computer programs) stored thereon, which are used to execute the fault location method of the cluster system in the above embodiments.

[0132] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory (EPROM), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, radio frequency (RF), etc., or any suitable combination thereof.

[0133] The aforementioned computer-readable storage medium may be included in the fault location device of the cluster system; or it may exist independently and not be assembled into the fault location device of the cluster system.

[0134] The aforementioned computer-readable storage medium carries one or more programs that, when executed by the fault location device of the cluster system, enable the fault location device of the cluster system to improve the accuracy of locating the fault type and root cause of the cluster system.

[0135] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0136] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0137] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0138] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the fault location method of the above-described cluster system, which can improve the accurate location of fault types and root causes in the cluster system. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the fault location method of the cluster system provided in the above embodiments, and will not be repeated here.

[0139] Based on the same inventive concept, this application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the fault location method for a cluster system as described above.

[0140] The computer program product provided in this application can improve the accurate location of fault types and root causes in cluster systems. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the fault location method for cluster systems provided in the above embodiments, and will not be repeated here.

[0141] The above are only some embodiments of this application and do not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A fault location method for a cluster system, characterized in that, The fault location method for the cluster system includes: Obtain the current cluster system's runtime snapshot information, which includes log information and multi-dimensional metric information; The log information is preprocessed to obtain a log information vector, and the indicator information of each dimension is preprocessed to obtain an indicator information vector. The log information vector and the indicator information vector are fused to obtain a fused feature vector; The fused feature vector is processed by a pre-trained extreme gradient boosting classifier to obtain the fault type of the current cluster system and locate the root cause of the fault. The extreme gradient boosting classifier is trained by mapping historical operation snapshot information with historical fault types and historical fault root causes.

2. The fault location method for a cluster system as described in claim 1, characterized in that, The preprocessing of the log information to obtain the log information vector includes: The log information is converted to a text format to obtain log information. The log information in the text format is cleaned to obtain cleaned log information; The cleaned log information is classified into text types to obtain the log information's log type; The log information is encoded using a one-hot encoding method for each log type, and the feature vectors obtained from the encoding of each log type are concatenated to obtain the log information vector.

3. The fault location method for a cluster system as described in claim 1, characterized in that, The preprocessing of the indicator information for each of the aforementioned dimensions to obtain the indicator information vector includes: The indicator information for each of the aforementioned dimensions is normalized. The normalized index information of each dimension is concatenated to obtain the index information vector.

4. The fault location method for a cluster system as described in any one of claims 1 to 3, characterized in that, The fault location method for the cluster system further includes: Obtain historical operation snapshot information, which includes historical fault operation snapshot information and historical normal operation snapshot information; The historical operation snapshot information is preprocessed to obtain a historical operation snapshot information vector; By setting vector labels on the historical operation snapshot information vector, the historical fault types and historical fault root causes corresponding to the historical operation snapshot information are obtained; The historical fault types and root causes are encoded using a one-hot encoding method to obtain encoded historical fault type vectors and historical fault root cause vectors. The historical fault type vector, the historical fault root cause vector, and the historical operation snapshot information vector are concatenated to obtain the historical fusion feature vector; The initial extreme gradient boosting classifier is trained using the historical fusion feature vector to obtain a trained extreme gradient boosting classifier.

5. The fault location method for a cluster system as described in claim 4, characterized in that, The historical operation snapshot information includes historical log information and historical indicator information of multiple dimensions. The preprocessing of the historical operation snapshot information to obtain the historical operation snapshot information vector includes: The historical log information is preprocessed to obtain a historical log information vector, and the historical indicator information of each dimension is preprocessed to obtain a historical indicator information vector. By concatenating the historical log information vector and the historical indicator information vector, the historical running snapshot information vector is obtained.

6. The fault location method for a cluster system as described in claim 4, characterized in that, The step of training the initial extreme gradient boosting classifier using the historical fusion feature vector to obtain the trained extreme gradient boosting classifier includes: Based on the historical fusion feature vector, the length of the vector label corresponding to each historical operation snapshot information is obtained, as well as the historical actual fault type, historical actual fault root cause, historical predicted fault type and historical predicted fault root cause corresponding to each historical operation snapshot information. The loss value corresponding to each historical operation snapshot is calculated using a logarithmic loss function based on the length of the vector label corresponding to each historical operation snapshot information, the actual historical fault type, the actual historical fault root cause, the predicted historical fault type, and the predicted historical fault root cause. The total loss value is obtained by summing the loss values ​​corresponding to each of the historical snapshot information. If the total loss value is greater than the preset loss value, the classifier parameters of the initial extreme gradient boosting classifier are adjusted, and the logarithmic loss function is recalculated. If the total loss value is less than or equal to the preset loss value, training stops and the extreme gradient boosting classifier is output.

7. A fault location device for a cluster system, characterized in that, The fault location device of the cluster system includes: The acquisition module is used to acquire the current cluster system's runtime snapshot information, wherein the runtime snapshot information includes log information and multi-dimensional indicator information; The preprocessing module is used to preprocess the log information to obtain a log information vector, and to preprocess the indicator information of each dimension to obtain an indicator information vector. Fusion processing is used to fuse the log information vector and the indicator information vector to obtain a fused feature vector; The analysis module is used to process the fused feature vector through a pre-trained extreme gradient boosting classifier to obtain the fault type of the current cluster system and locate the root cause of the fault. The extreme gradient boosting classifier is trained by mapping historical operation snapshot information with historical fault types and historical fault root causes.

8. A fault location device for a cluster system, characterized in that, The fault location device of the cluster system includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the fault location method of the cluster system as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the fault location method for the cluster system as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the fault location method for a cluster system as described in any one of claims 1 to 6.

Images